[st123]

I'm lost on the last question. I used disk internals recovery tool to check number of files in c:\users\ but the number is wrong ?

[IceFrog]

Awesome! Thanks for Sharing ...

[DouglDoul]

3471

Just same thanks, don't ask how 

[4ip0k]

Hello community. I’m generally new to investigations (I’m more of a pentester). Is there any standard for investigations?

[Joebiden456]

What tools did you guys use for this Sherlock, and also how did you find the password for the question:
"The user has made notes of their work credentials, what is their password?"

[peRd1]

What tools did you guys use for this Sherlock, and also how did you find the password for the question:
"The user has made notes of their work credentials, what is their password?"

Timeline Explorer, Mft2Csv, and ZimmermanTools.

What you looking for is ReallyC00lDucks2023! but yeah, use those tools, search for password, ppt, slides, docs, http, etc.

[st123]

3471

Just same thanks, don't ask how 

Thanks for this !!

---

Awesome! Thanks for Sharing ...

No problem . : )